Auditing Cryptocurrency Companies – The CPA Journal

Recent events in the cryptocurrency industry highlight the risks for investors and customers—as well as auditors. This article summarizes the international, U.S. GAAP, and PCAOB auditing standards and practices relevant to audits of crypto companies. To better understand the auditing environment for, and the riskiness of, cryptocurrency companies, the audit reports and financial statements of 55 cryptocurrency companies publicly traded on U.S. markets for the years 2023 and 2022 are examined and profiled. Concerns about recent declines in audit quality in general and audits of cryptocurrency companies specifically are raised. Audits of private cryptocurrency companies are also addressed, including the now infamous FTX. Although progress is being made in accounting and auditing standards, more remains to be done, and further legislative and regulatory actions are needed to protect investors, customers, and other stakeholders.

***

As described in the PCAOB quote above, the cryptocurrency industry is inherently risky. Given this context, this article examines the role and responsibilities of the accounting profession to protect the public interest and to adhere to professional standards in conducting audits in the cryptocurrency industry.

The cryptocurrency industry has been volatile, with recent high-profile bankruptcies, lawsuits, and settlements. Two cryptocurrency exchanges and their leaders have been the subject of public notoriety. FTX, a large private cryptocurrency exchange, went bankrupt in November 2022 and its CEO, Sam Bankman-Fried was later indicted and found guilty on seven counts of fraud (David Yaffe-Bellany, Matthew Goldstein, and J. Edward Moreno, “Sam Bankman-Fried Is Found Guilty of 7 Counts of Fraud and Conspiracy,” The New York Times, Nov. 2, 2023, https://bit.ly/3v0cHTS). Bankman-Fried was sentenced to 25 years in prison (Bob Van Voris, Chris Dolmetsch, and Ava Benny-Morrison, “Bankman-Fried is Sentenced to 25 Years in Prison Over FTX Collapse,” Bloomberg, March 28, 2024, https://bit.ly/3yJK5ji). Binance, another large private cryptocurrency exchange, and its CEO, Changpeng Zhao, pleaded guilty to money laundering and other charges. Binance agreed to pay the government more than $4 billion and Zhao agreed to resign as CEO (Department of Justice, “Binance and CEO Plead Guilty to Federal Charges in $4B Resolution,” Nov. 21, 2023, https://bit.ly/3No7USv). Zhao was sentenced to four months in prison (Ava Benny-Morrison, “Binance Founder Changpeng Zhao Gets Four Months in Prison,” Bloomberg, April 30, 2024, https://bit.ly/3WYSuJV).

There are currently thousands of digital currencies, the best-known being Bitcoin and Ethereum. Cryptocurrencies may be used as a method of payment and are traded on crypto exchanges, which may be privately held (e.g., Binance and FTX) or publicly held (e.g., Coinbase Global). There are also numerous other activities and businesses in the cryptocurrency environment, including bitcoin mining companies, fintech and decentralized finance companies, and companies that make significant investments in bitcoin and other cryptocurrencies as their primary business strategy.

Regulatory and Legislative Uncertainty

Regulatory uncertainty surrounding crypto assets translates into on-going business and accounting risks for crypto companies. The SEC regulates securities, and the Commodity Futures Trading Commission (CFTC) regulates commodities. Other than bitcoin, however, which everyone seems to agree is a commodity, there is a lack of agreement on the nature (security or commodity) of most other cryptocurrencies. The crypto industry has lobbied for different regulatory regimes for cryptocurrencies, but the SEC has resisted, citing the sufficiency of existing regulations and precedents for crypto definitions and SEC jurisdictional authority over securities (SEC Chair Gary Gensler, “Statement on the Denial of a Rulemaking Petition Submitted on behalf of Coin-base Global, Inc.,” Dec. 15, 2023, https://bit.ly/3Nt3Sbd). Congress has been considering various legislative bills that would provide definitive legal guidance for how and by which agencies cryptocurrencies should be regulated (Jason Brett, “Congress Creates A Storm Of Crypto Legislation,” Forbes, August 3, 2023, https://bit.ly/41qYAmA). Until there is bipartisan agreement and comprehensive legislation is passed, however, crypto companies will continue to face associated business risks and possible uncertainty when accounting for specific types of crypto assets.

Applicable Professional Standards

Global standards for financial reporting are primarily promulgated by FASB, which sets Generally Accepted Accounting Principles for both public and private companies in the United States, and the International Accounting Standards Board (IASB), which provides accounting standards for most of the rest of the world through its International Financial Reporting Standards (IFRS). Under existing IFRS, accounting for cryptocurrency holdings falls under either IAS 2, Inventories (if crypto-currencies are held for sale as part of business operations), or IAS 38, Intangible Assets. Under IFRS guidelines, both decreases and increases in the fair value of crypto assets are recognized using a fair value approach. Under U.S. GAAP, crypto assets are treated as intangible assets with indefinite useful lives and are valued at cost less impairment with subsequent increases in value not recognized, in accordance with ASC 350.

In March 2023, FASB issued an exposure draft on “accounting for and disclosure of crypto assets” (see W.M. VanDenburgh, R.B. Daniels, and R. DeLaurell, “FASB Takes on Crypto,” The CPA Journal, November 2023, https://bit.ly/413LFXG). In December 2023, FASB issued ASU 2023-08, Accounting for and Disclosure of Crypto Assets, (https://bit.ly/41nKH8P). The ASU provides for reporting the fair value of crypto assets, the reporting of gains as well as losses, and other disclosures, for assets that meet FASBs carefully defined set of criteria. ASU 2023-08 is effective for fiscal years beginning after December 15, 2024, and early adoption is permitted. This is an important step toward clarity for cryptocurrency company preparers, auditors, and investors.

Audits of Publicly Traded Cryptocurrency Companies

To understand the role of auditors and auditing in the cryptocurrency industry, 55 “cryptocurrency” companies traded in the United States on the NYSE, Nasdaq, or over-the-counter markets were selected for analysis. The companies were selected through developing a potential list of publicly traded cryptocurrency companies by: 1) searching companies whose SEC annual filings included the word “cryptocurrency” (using the Wharton Research Data Services SEC Analytic Suite) and 2) conducting a Google search for “publicly traded crypto-currency companies.” The list was reduced by qualitatively eliminating companies without a substantial portion of their business associated with the cryptocurrency industry. The final sample of 55 entities is not intended to be a comprehensive or complete list of cryptocurrency companies, but it should provide an adequate, if imperfect, sample to review attributes of publicly traded cryptocurrency companies. Audited financial statements and audit reports were examined for the two most recent fiscal years, 2023 and 2022 (41 companies have a calendar year-end of December 31). Exhibit 1 lists these companies.

For the purposes of this survey, all references to the size of companies are based on market capitalizations as of December 29, 2023. Exhibit 2 presents the auditors and number of audit clients for the sample. In 2023 (2022), Marcum had the most clients, with 6 (7), followed by KPMG, with 5 (5), of which only one is conducted by a U.S. office of KPMG. In 2023 (2022), the Big Four audited 10 (9) of the total sample, but they audited 5 (4) of the 10 largest companies. None of the smallest 20 companies were audited by the Big Four in either year. In both years, less than 20% of the sample was audited by the Big Four. These results are consistent with more careful client selection by Big Four firms (see, e.g., D. Aobdia, L. Enache, and A. Srivastava, “Changes in Big N Auditors’ Client Selection and Retention Strategies Over Time,” Review of Quantitative Finance and Accounting, 2021, https://doi.org/10.1007/s11156-020-00907-8).

A profile of the 55 companies is provided in Exhibit 3. Of the 10 largest companies in 2023, only three were foreign filers (Nu Holdings, Hut 8 Mining, and Bitdeer Technologies). Of the 10 smallest companies, six were foreign companies and all six filed through SEDAR+ [System for Electronic Data Analysis and Retrieval+, the “Canadian Securities Administrator’s national system that all market participants will use for filings, disclosures, payments and information searching in Canada’s capital markets” (https://bit.ly/3GAJ5P7)]. Most foreign companies use IFRS accounting standards instead of U.S. GAAP. Auditors’ reports on the financial statements are based on the relevant auditing and financial reporting standards.

The overall results shown in Exhibit 3 are consistent with the common preconception that cryptocurrency is an emerging, risky industry. The companies were overwhelmingly smaller companies, with 35 in the micro-cap or nano-cap categories. Of the U.S. companies, 14 filed as “emerging growth companies.” In 2023 (2022), 47 (51) companies reported losses, with not one company reporting profits in both years, demonstrating the challenges of profitability in the crypto industry. The 2023 results were not much better than 2022, even though the cryptocurrency market had turned around after hitting a low point in November 2022. The market capitalization of all cryptocurrencies (bitcoin) had reached a low of about $936 billion ($302 billion) in November 2022 but had recovered by the end of 2023 to about $1.7 trillion ($825 billion) (https://coingecko.com). In fact, three of the eight companies reporting a profit in 2023 did so through early adoption ASU 2023-08, which provided sufficient unrealized gains on bitcoin to turn a loss into a profit. Given the number of companies with losses, it is not surprising that auditors added a going concern paragraph to their audit report in 2023 (2022) for 23 (25) of the 55 companies. All ten of the smallest companies had going concern paragraphs in their audit reports, while none of the largest ten companies had a going concern paragraph. Under section 404 of the Sarbanes-Oxley Act of 2002, U.S. public companies are required to assess and report on internal controls over financial reporting (ICFR). This is required of management in all cases [SOX section 404(a)]. Auditors of larger public companies, deemed accelerated or large accelerated filers, must also evaluate and render an opinion on the client’s effectiveness of ICFR. Auditors of smaller companies, deemed non-accelerated filers, or small reporting companies, or emerging growth companies, are not required to render an opinion on ICFR [SOX section 404(b)]. In 2023 (2022), there were 47 (48) companies that did not require the auditor to render an opinion on the effectiveness of ICFR. Of the eight companies whose auditors were required to report on ICFR in 2023, six had unqualified opinions and two had adverse opinions. Of the 47 (48) remaining companies, management of 11 (15) of the companies reported one or more material weaknesses. Recently, Bedrock AI identified 19 publicly traded crypto mining companies and found that 16 of the 19 (84%) had disclosed material weaknesses in ICFR at some point during the past four years (A. Castillo, “FTX: Anomaly or Norm? Field Notes on the Crypto Mining Space,” 2022, https://bit.ly/3T7AMSF).

The audit reports for the sample of companies were also reviewed for inclusion of Critical Audit Matters (CAMs) or Key Audit Matters (KAMs). The PCAOB instituted CAMs for public company auditors for fiscal years on or after December 15, 2020 (PCAOB, 2017, https://bit.ly/485hRvO). The requirement for large accelerated filers was one year earlier. The CAMs requirements apply to “smaller reporting companies” but do not apply to “emerging growth companies.” A similar standard for KAMs was adopted by the IAASB in 2014 as International Standards on Auditing (ISA) 701 (https://bit.ly/3XnF4We) and by the ASB as AU-C Section 701. ISA 701 applies to “listed entities,” which includes the companies discussed here. AU-C Section 701 applies to private company audits in the United States. Among other things, a “critical audit matter is any matter arising from the audit of the financial statements that was communicated or required to be communicated to the audit committee” and “involved especially challenging, subjective, or complex auditor judgment” (PCAOB AS 3101.11, https://bit.ly/3NzazZk).

In 2023 (2022), either CAMs or KAMs were included in the audit reports of 36 (30) of the companies in the sample. The additional auditor comments did not exist just for smaller companies, with 9 of the 10 largest companies including CAMs in their 2023 audit report. Although the reasons varied, many of the CAMs and KAMs were specifically related to cryptocurrency matters. For example, CAMs and KAMs included descriptions of audit procedures for “evaluation of the accounting for and disclosure of bitcoin mining revenue recognized” and “customer crypto assets, crypto assets held, and USDC-crypto assets held in cold storage.”

This sample of publicly traded cryptocurrency companies provides insights into the characteristics of the crypto-currency industry. The companies were overwhelmingly smaller companies audited by non-Big Four firms. In general, these companies are struggling financially and have numerous accounting and auditing challenges.

Ongoing Audit Quality Concerns for Public Company Audits

Audit quality remains a concern for regulators, investors, and other interested parties. There is no information available about the audit quality for the specific audits of the 55 companies in the sample. There is, however, evidence of a general increase in “flawed” audits. Based on the most recent publicly available PCAOB inspection reports, “serious” audit deficiencies increased “for nearly every category of the 157 audit firms the PCAOB inspected in 2022,” on which Erica Williams, chair of the PCAOB, commented “a 40% Part 1.A deficiency rate is completely unacceptable” (PCAOB, Chair Williams Statement on Rise in Audit Deficiency Rates, July 25, 2023, https://bit.ly/3KhFZRZ). Recent actions against some of the specific auditors in the sample of 55 companies are also troubling. Marcum, LLP, the auditor for six companies in the sample in 2023 and seven in 2022, agreed to pay a $10 million penalty to settle SEC charges that it had “systematic quality control failures and violations of audit standards in connection with audit work for hundreds of special purpose acquisition company (SPAC) clients” and these problems were “not limited to SPAC clients, but reflected systemic quality control failures throughout the firm” (SEC, “SEC Charges Audit Firm Marcum LLP for Widespread Quality Control Deficiencies,” June 21, 2023, https://bit.ly/3yJICcM). MaloneBailey, LLP, the auditor for five companies in the sample in 2023 and four companies in 2022, was fined $400,000 by the PCAOB for “pervasive quality control violations” (PCAOB, “Imposing a $400,000 Fine, PCAOB Sanctions MaloneBailey, LLP for Pervasive Quality Control Violations,” May 21, 2024, https://bit.ly/3R1g6K8). The PCAOB found that BF Borgers CPA PC, an accounting firm that audited two companies in the sample for 2022 and one company for 2023, had significant deficiencies in all 11 audits reviewed in 2022 (PCAOB, “2022 Inspection BF Borgers CPA PC,” Nov. 7, 2023, https://bit.ly/3VidKJt). In a separate action, the SEC charged BF Borgers CPA PC with “deliberate and systematic failures to comply with” PCAOB standards “in more than 500 public company SEC filings” (Securities and Exchange Commission, “SEC Charges Audit Firm BF Borgers and Its Owner with Massive Fraud Affecting More than 1,500 SEC Filings,” May 3, 2024, https://bit.ly/4bRcwdx). BF Borgers and the owner settled the charges by agreeing that the firm would pay $12 million, Benjamin Borgers would pay $2 million, and both were permanently suspended “from appearing and practicing before the Commission as accountants.”

There were 19 companies in the sample that filed annual financial results through the Canadian SEDAR+ system. Fifteen of the 19 audit reports were issued by 11 firms that followed Canadian Generally Accepted Auditing Standards. Similar to the PCAOB, the Canadian Public Accountability Board (CPAB) inspects accounting firms conducting audits for Canadian issuers (CPAB, https://bit.ly/3R6nG6b). In 2023, the CPAB imposed enforcement actions on three firms conducting audits in the sample—BF Borgers CPA PC, PKF Antares, and Marcum LLP, including terminating BF Borgers CPA PC (CPAB, Resource Centre, https://bit.ly/4dXLbIr). In May 2024, the CPAB provided “insights and illustrative examples” for auditing crypto companies, noting that they “identified significant findings” in 23 of 33 audit files inspected from 2020 to 2023 for reporting issuers “with crypto-asset activities” (CPAB, “Crypto Asset Inspections Insights,” May 2024, https://bit.ly/4bAMUSj). This information indicates the CPAB is aware of certain quality concerns for specific auditors and that crypto companies are high risk audits that require increased audit attention.

Audits of Private Crypto Companies and the Case of FTX

Audits of publicly traded crypto-currency industry companies carry their own risks, but audits of private cryptocurrency companies have less visibility and less scrutiny (the AICPA’s Peer Review Program brings the most notable form of scrutiny). Nevertheless, the impact on investors, customers, and the public can be significant. A Bloomberg News 2023 survey of 60 “major” crypto companies found that “only a handful of the 60 firms are publicly traded and beholden to certain regulatory standards” (E. Nicolle, “Crypto’s Most Influential Companies Often Follow Their Own Rules—Even After FTX’s Collapse,” Bloomberg, May 15, 2023, https://bit.ly/3NTq52L). The survey results showed that about half of the companies have annual financial audits and 63% have an independent board with at least one non-executive member. There were 10 companies without an independent board member and 7 without independent audits; 22 of the 60 respondents did not provide information about independent audits.

FTX, a privately held crypto company, was ranked fifth among the largest cryptocurrency exchanges by trading volume through November 9, 2022 (Reuters, “Top Crypto Exchanges by Volume,” 2022, https://bit.ly/3GtpJeP). On November 11, 2022, FTX.com and 130 affiliated companies declared bankruptcy. The visibility of high-profile bankruptcies and frauds in the crypto industry and related audit issues has led to scrutiny of the audit profession by Congress. For example, in a letter addressed to the chair of the PCAOB, two United States senators questioned “the role that auditors may have played in misleading the public about financial soundness of crypto companies” (Elizabeth Warren and Ron Wyden, “Letter to Erica Y. Williams,” Jan. 25, 2023, https://bit.ly/3Rpv2RR). In the letter, they question the quality of audits by Armanino and Prager Metis of FTX.US and FTX (International), respectively, as well as the standards to which the auditors should have been held.

When FTX declared bankruptcy, Bankman-Fried was relieved of his position as CEO and replaced by John J. Ray III. In a filing with the bankruptcy court, Ray stated that “Never in my career have I seen such a complete failure of corporate controls and such a complete absence of trustworthy financial information as occurred here” (John J. Ray III, Nov. 17, 2022, https://bit.ly/3NfjEGV). One allegation against Bankman-Fried was that he and other employees misled auditors and withheld information about comingling customer funds (United States v. Bankman-Fried, 2023, p. 12, https://bit.ly/46LiGZH). Bankman-Fried then used the audited financial statements to “falsely reassure customers and investors that FTX had proper risk management controls and systems for storing customer accounts” (p. 13). Bankman-Fried then used the audited financial statements to “falsely reassure customers and investors that FTX had proper risk management controls and systems for storing customer accounts” (p. 13).

The bankruptcy disclosures raise questions about how the auditors were able to provide unqualified opinions for a company that had few or no controls. In a public company or private company audit, the auditor must still understand the client and its control environment, including the client’s internal control relevant to the audit (AU-C section 315; ISA 315). Auditors must assess and document the risk of material misstatements and the impact on the assessment of the client’s control environment and ICFR on the audit risk model and for “designing the nature, timing and extent of substantive procedures.” Both AU-C 315 and ISA 315 note the auditor may determine that “substantive procedures alone do not provide sufficient appropriate audit evidence.” A class-action suit against numerous defendants includes alleged violations of professional standards by Armanino and Prager Metis in their audits (In Re: FTX Cryptocurrency Exchange Collapse Litigation, U.S. District Court S.D. of Florida, “Administrative Class Action Complaint and Demand for Jury Trial: Auditor Defendants,” August 8, 2023, https://bit.ly/3RxWmOS). In a recent settlement with the SEC, Prager Metis agreed to pay $1.95 million related to SEC complaint charges for “negligence-based fraud” for its FTX audits and previous auditor independence violations and the accounting firm agreed to “undertake remedial actions” (SEC, “Audit Firm Prager Metis Settles Charges for Negligence in FTX Audits and for Violating Auditor Independence Requirements,” Sep. 17, 2024, https://bit.ly/41hdspu). Although the bankruptcy documents and lawsuit also raise questions about the audits by Armanino, there have been no definitive conclusions about any mistakes or wrongdoings from a court of law or by regulators.

Going Forward

There continue to be many concerns with the nascent crypto industry. There are some positive developments, however, not the least of which is FASB’s newly issued authoritative guidance on accounting and disclosure for crypto assets (ASU 2023-08). CPA firms, particularly the Big Four, are developing auditing tools to address crypto assets, and professional organizations are providing non-authoritative guidance for their members (e.g. AICPA & CIMA, “Accounting for and Auditing of Digital Assets Practice Aid,” Sep. 30, 2023, https://bit.ly/41jeM9t). As outlined above, there are numerous professional standards that are relevant to audits of crypto clients. There are also revised professional guidance and crypto practice updates from the PCAOB and others. The reputation of individual accounting firms and the profession require every auditor to pay close attention to relevant auditing and attestation standards before issuing an opinion; not every entity may be capable of being audited.

Legislation from the U.S. Congress that specifically addresses the regulatory landscape for cryptocurrency is critical to protecting investors, customers, and other stakeholders in the cryptocurrency industry. Comprehensive legislation would also reduce business risk and accounting uncertainties, which would then reduce some audit risks. Based upon the risk factors surrounding the crypto regulatory environment listed in many of the 10-Ks in the sample companies, the most important issues to be resolved include the status of crypto assets as either “securities” or “commodities” and the related concern about which regulatory agency is responsible for making that determination and overseeing the industry.

For crypto mining companies, primarily bitcoin miners, there is uncertainty about environmental regulations related to the significant energy requirements for mining. As noted above, there have been numerous legislative proposals. There has also been independent analysis of what is needed (e.g., U.S. Government Accountability Office, “Blockchain in Finance,” 2023, https://bit.ly/3MRVlOl). The House of Representatives passed a crypto bill, but it has received mixed reviews and was not passed by the Senate (J. Shapiro, “House Passes Bill Outlining new Framework for Crypto Regulation Despite SEC Pushback,” The Hill, May 22, 2024, https://bit.ly/4e13kVy). The November elections, however, resulted in a “pro-crypto” president-elect and Congress going into 2025, which will likely lead to different legislation (Ryan Browne, “Coinbase Policy Chief Expects Speedy Approval of Crypto Laws Following Trump’s Victory,” CNBC, Dec. 2, 2024, https://bit.ly/3B0iJas).